2

It seems I am trying to do the same as the user who asked this question: Unlock LUKS partition using keyfile without root access?

The answer from frostschutz explains that this is impossible. I am hoping to understand the alternatives in more detail.

  • udisksctl works without root access, using udiskctl loop-setup followed by udiskctl unlock (I tested it). How does it work around not having root access? [Not admitting keyfiles is a major drawback anyway, but it would still be helpful to know.]
  • cryptmount http://cryptmount.sourceforge.net/ looks like it might work but it's also unclear to me how cryptmount works around not having root access. Moreover, I prefer to minimize extra packages where possible, particularly cryptographic ones.
  • GPG-encrypted tar, as explained by frostschutz, would be a sensible alternative, but I'd hope to make LUKS work.
  • Are there any other options I haven't considered? Fiddling with udev/sudoers?
Community
  • 1
SauceCode
  • 2,275
  • 4
  • 21
  • 32
  • You're referring to http://en.wikipedia.org/wiki/Setuid binaries - you effectively are using root access with those. – frostschutz Apr 14 '15 at 19:47
  • i.e. udiskctl and cryptmount both use setuid under the hood? – SauceCode Apr 14 '15 at 20:13
  • Do you have assess to root (or can you ask your admin), to set things up? There will be tools that can do it, but need root for at least the install. (if they need special privileges, then there is no way to install without root access. ) – ctrl-alt-delor Apr 14 '15 at 20:18
  • Yes, I have access to root for the purpose of setting things up. – SauceCode Apr 14 '15 at 20:45
  • @SauceCode `udisks` is not setuid root, but it communicates with a service daemon over dbus which runs as root, and it's that daemon that does the real work. `cryptmount`, I don't know about — it may or may not be setuid. – Celada Apr 14 '15 at 21:01
  • I see. From what I have read, using setuid securely is a bit of a minefield. I presume udiskctl implements this privilege elevation properly since it comes packaged with my system. That leads me to wonder if there is some way to use udiskctl to handle the loop device setup, but then unlock the volume itself without using root. I don't know whether that is possible, though. – SauceCode Apr 14 '15 at 21:31
  • ... Cryptmount man page mentions that it requires setuid privileges. – SauceCode Apr 15 '15 at 09:03

0 Answers0